I've been spending some of my time bringing up racoon2 (an IKEv2 and IKEv1 daemon) on OpenSolaris.
Because of vast differences in PF_KEY implementations between OpenSolaris and other OS kernels, I've spent my racoon2 time actually getting IKEv1 to work first, instead of IKEv2. Right now, what's working is:
- IKEv1 initiates and derives IPsec SAs for single-algorithm IPsec policies.
That's it! IKEv1 responder needs work, as does all of IKEv2, as does work
for multiple-choice of algorithms. But there's enough change in there to say
something now.
ARCHITECTURAL DIFFERENCES
The most noteworthy change in the OpenSolaris work so far is that literally
there's no spmd (a separate IPsec SPD daemon racoon2 uses) required for now. This is because:
- We don't have the indirection between ACQUIREs and the appropriate policy entry. Our extended ACQUIREs contain everything needed to construct a proposal. There's no SPD consultation required with an OpenSolaris ACQUIRE.
- Our responder-side logic uses inverse-ACQUIRE, which will provide the same structure as ACQUIRE w.r.t. proposal construction. This is the closest we get to needing something like spmd, and given its syntactic equality to an extended ACQUIRE, we can use it on rekeying if the responder initiates the next time.
If spmd serves another purpose, we will revisit it. As it stands, however, I cannot see us using it.
CODE DIFFERENCES
In OpenSolaris, we use the "webrev" tool to generate easy-to-review web pages
with diffs of all varieties. The webrev for what I have so far in racoon2 is
available at:
http://cr.opensolaris.org/~danmcd/racoon2-opensolaris/
Feel free to make comments or suggestions about what I've done.
